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Braking System For Vehicles, In Particular 
Utility Vehicles, Comprising At Least 
Two Separate Electronic Braking Control Circuits 

5 RELATED APPLICATION INFORMATION 

The present application claims the benefit of and was 
filed as PCT/EP2004/004810 on May 6, 2004 which claims 
priority to German patent application no. 103 2 0 608.6, 
which was filed in the German patent office on May 8, 
10 2003. Both applications (including the English 

translation of PCT/EP2004/004810 filed herewith) are all 
hereby incorporated by reference in their entirety. 

FIELD OF THE INVENTION 

The present invention relates to a braking system for 
15 vehicles. 

BACKGROUND INFORMATION 

DE 199 04 721 Al refers to an electromechanically 
actuated vehicle braking system which has electrical 
braking control circuits, namely one for the brakes on 

20 the front axle and one for the brakes on the rear axle. 
The two control circuits each have their own power supply 
and their own electronic control unit, which are 
electrically connected to a brake pedal . The two control 
units operate independently of one another but can 

25 communicate with one another and can thereby detect 
faults in a control unit. A fault is then deemed to be 
present when the two control units determine different 
control signals from the same sensor input signals. In 
the event of a fault, the two control units are 

3 0 deactivated and the brakes are then controlled by 
decentralized control units which are assigned to the 
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individual wheels and can perform only simple basic 
functions . 

Modern utility vehicle braking systems have a dual- 
circuit pneumatic control system and an electronic 
5 braking control system, thus making it possible to 
transmit signals in a more rapid manner and improving the 
response behavior of the braking system. The costs of 
electromechanical control components are also frequently 
lower than the costs of pneumatic control components. 

10 Another advantage is the lower outlay on installation. 
Electropneumat ic braking systems, in particular, in which 
the braking force is applied using compressed air but 
braking is controlled electronically are customary 
nowadays. A fundamental "quality criterion" of electrical 

15 or electronic braking control systems is their 
reliability or fail-safety. 

DE 199 15 253 Al refers to a braking system for vehicles, 
said braking system having two brake circuits and 
containing, in a central unit, two microcomputers which 

2 0 are each supplied with power from separate power sources. 
The two microcomputers activate a plurality of brake 
actuating devices for individual wheel brakes using two 
separate redundant bus systems. This activation is always 
effected in a parallel manner using the two bus systems. 

25 Measuring devices which are coupled to a brake pedal are 
provided in order to activate the two microcomputers. 

DE 35 02 049 A refers to a brake pressure control device 
for a motor vehicle having a foot brake valve which 
transmits signals to an electronic control unit which, 
30 for its part, activates pressure-regulating valves for 
wheel brakes. 
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WO 01/62569 A refers to an electronic braking control 
system having three power sources for the power supply. 
The power sources are decoupled from one another by 
diodes. 

5 DE 196 40 148 A refers to an electronic braking system 
having a plurality of vehicle modules which communicate 
via a data bus. individual modules are DC-isolated from 
one another by optocouplers . 

DE 195 09 150 A refers to a vehicle braking system having 
10 at least two brake circuits, said braking system 
respectively having a control unit which is controlled 
microprocessors which are independent of one another. A 
monitoring computer monitors the two other control units. 

DE 32 04 185 A refers to a pressure -medium braking system 
15 having a foot brake valve which electrically activates 
braking control valves. 

SUMMARY OF THE INVENTION 

It is an object of the exemplary embodiment and/or 
exemplary method of the present invention to provide a 
20 braking system which can be activated electrically, has 
increased fail-safety or reliability and can, in 
particular, also carry out higher functions such as ABS, 
ASR, EBS etc. 

This object may be achieved by the subject matter 
25 described herein. Advantageous refinements and 
developments of the exemplary embodiment and/or exemplary 
method of the present invention are also described 
herein . 

The exemplary embodiment and/or exemplary method of the 
30 present invention concerns a braking system comprising at 
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least two or more electrical or electronic braking 
control systems, individual brake actuators or groups of 
brake actuators being assigned to different braking 
control systems , to be precise in such a manner that 
5 there are brake actuators which can be activated by a 
plurality of braking control systems. 

In the event of a braking control system failing or 
developing a fault, control at "critical" wheels is 
immediately assumed by another braking control system. 

10 The individual braking control systems may be isolated 
from one another in such a manner that a fault in one of 
the braking control systems does not affect the other 
braking control system(s). The individual braking control 
systems may be DC- isolated from one another. 

15 Despite being isolated, the individual braking control 
systems may communicate with one another in order to make 
it possible for another braking control system to rapidly 
assume the braking control function, in order to 
coordinate braking activities of brake actuators which 

2 0 are activated by different braking control systems and in 

order to exchange parameters which have been learnt . 

The brake actuators which are activated by the electronic 
braking control systems may be "pneumatic brake 
actuators" , that is to say in which the braking force is 
25 applied pneumatically. This is because, in the case of 
electrically actuated brake actuators which are currently 
available, it is not yet possible to build up a 
satisfactory or sufficient braking force. 

The braking system may be arranged to "easily" change 

3 0 over from the electropneumatic brake components used 

nowadays to purely electrically controlled components. 
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According to one development of the exemplary embodiment 
and/or exemplary method of the present invention, the 
control circuits each have their own electronic control 
unit and their own power supply. The electrical control 
5 circuits activate elect ropneumatic pressure regulation 
modules which are supplied with brake pressure by at 
least two pneumatic supply circuits. 

The brake circuits may be divided between individual 
vehicle brakes in different ways. 

10 One option is to assign a brake circuit to a vehicle axle 
or group of axles. Each brake circuit may have its own 
control circuit and its own supply circuit, that is to 
say one supply circuit and one control circuit are then 
exclusively assigned to one brake circuit. 

15 Another option is to provide a first brake circuit, which 
has the function of a service brake circuit, and a second 
brake circuit, which assumes the function of the service 
brake circuit, the braking operations being alternately 
divided equally between the brake circuits. The non- 
20 active brake circuit is respectively tested for faults in 
this state. In the event of a brake circuit failing, the 
functions are immediately assumed and carried out by the 
other brake circuit, further changeovers being effected 
but a faulty function being carried out by a redundant 
25 fault-free function. Each brake circuit is respectively 
provided with its own electronic control unit, said 
electronic control units being able to communicate with 
one another via a communications line in such a manner 
that they are DC- isolated. The service brake circuit may 
3 0 have two separate subsupply circuits which are each 
connected to their own associated pressure-medium store. 
The first subsupply circuit is provided, for example, for 
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the purpose of applying pressure to pressure regulation 
modules on a front axle, and the other subsupply circuit 
is provided for the purpose of applying pressure to 
pressure regulation modules on a rear axle. The second 
5 brake circuit likewise has its own pressure-medium store. 

BRIEF DESCRIPTION OF THE DRAWINGS 

Figure 1 shows a first exemplary embodiment in accordance 
with the exemplary embodiment and/or exemplary method of 
the present invention. 

10 Figure 2 shows a second exemplary embodiment in 

accordance with the exemplary embodiment and/or exemplary 
method of the present invention. 

Figure 3 shows a basic circuit diagram of the power 
supply system for the two braking control circuits; 

15 Figure 4 shows a schematic exemplary embodiment of a 
parking brake valve; and 

Figure 5 shows a schematic illustration of networked 
electronic control systems. 

DETAILED DESCRIPTION 

20 Fig. 1 shows a schematic illustration of an 
electropneumatic vehicle braking system. Front wheels 1, 
2 are each assigned a brake cylinder 3, 4, a brake lining 
wear sensor 5, 6 and a wheel speed sensor 7, 8. Brake 
pressure is applied to the brake cylinders 3, 4 by 

25 associated electropneumatic pressure regulation modules 
11, 12 (EPM) via pneumatic lines 9, 10. The two pressure 
regulation modules 11, 12 are connected in this case, via 
a common supply line 13, to a first compressed-air store 
14 which is assigned to the front axle. The brake lining 
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wear sensors 5, 6 and the wheel speed sensors 7, 8 are 
each connected to signal inputs of the pressure 
regulation modules 11, 12 via electrical lines 15, 16. 
The pressure regulation modules 11, 12 also each have an 
5 electrical control input 17, 18, the latter being 
connected to a first electronic control unit 20 via 
electrical lines 19 which are shown only schematically in 
this case. The electronic control unit 20 thus controls 
the braking of the front wheel brakes in this case. 

10 Rear wheels 21, 22 are each assigned a spring brake 
cylinder 23, 24, the latter being connected, via 
pneumatic brake lines 25, 26, to associated pressure 
regulation modules 27, 28 which are connected to a second 
compressed-air store 30 via a supply line 29. The spring 

15 brake cylinders 23, 24 are also connected to an 
electrically activatable locking valve 32 for a common 
compressed-air line 31. 

Like the front axle, the pressure regulation modules 27, 
28 are connected to associated brake lining wear sensors 

2.0 35, 36 and wheel speed sensors 37, 38 via electrical 
lines 33, 34. The pressure regulation modules 27, 28 have 
control inputs 39, 40 which are connected, via electrical 
lines 41 which are shown only schematically in this case, 
to a second electronic control unit 42 which activates 

25 the brakes of the vehicle rear axle in this case. 

The parking brake valve 32 which is shown in detail in 
fig. 4 and is described therein is connected to the first 
electronic control unit 20 via an electrical control line 
43 and to the second electronic control unit 42 via an 
30 electrical control line 44. A pneumatic line 46 also 
leads from the parking brake valve 32 to a third 
pressure-medium store 47 via a nonreturn valve 45. The 
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three pressure -medium stores 14, 30 and 47 are each 
connected to a common pressure distribution device 48 
which is fed by a pressure-generating device 49 
(compressor) . 

5 The two electronic control units 20, 42 are connected to 
an associated bus VehComl and VehCom2 , respectively, via 
electrical lines 50, 51. These bus lines are used to 
connect the vehicle braking system to other electrical or 
electronic vehicle systems. In particular, a braking 
10 request signal which is prescribed by the driver using 
the brake pedal is supplied to the electronic control 
units 20, 42 via these buses. 

The electronic control unit 20 is connected to a positive 
line VI via an electrical line 52. Accordingly, the 

15 electronic control unit 42 is connected to a second 
positive line V2 via an electrical line 53. The positive 
line VI is connected to the positive terminal of a first 
battery 54 and the second positive line V2 is connected 
to the positive terminal of a second battery 55. The 

20 positive terminals of the two batteries 54, 55 are 
connected to one another via a DC- isolation device 56, 
which will be explained in even more detail in connection 
with fig . 3 . 

The positive terminal of the battery 54 is also connected 
25 to an AC generator (dynamo) via a rectifier 57. 

The two electronic control units 20, 42 are also 
connected to one another via a communications line 58 and 
a DC-isolation device 59. 

In the case of the braking system shown in fig. 1, a 
3 0 "dual electronic control system" having two separate 
power supply devices is provided for the purpose of 
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improving the fail -safety. Even though the two electronic 
control circuits are DC-isolated from one another, the 
two batteries 54, 55 can have a common ground connection. 

The braking request signal from the driver is supplied to 
5 the two electronic control units using electrical brake 
pedal signals. Mechanical parts have a fail-safe design. 
By contrast, electronic components are duplicated and are 
mechanically isolated and DC- isolated from one another. 

In fig. 1, the "division" of the electronic control 
10 system corresponds to the "division" of the pneumatic 
supply circuits, that is to say the supply and control 
circuits are each divided between the front and rear 
axles . 

Fig. 2 shows a brake circuit which has been improved 
15 further and in which all of the vehicle brakes can be 

* 

actuated even in the event of a fault in the "primary 
brake circuit" . 

Fig. 2 shows a further development of the braking system 
shown in fig. 1. In this case too, the braking system has 

20 two brake circuits, namely a first brake circuit as the 
service brake circuit (primary circuit) , which controls 
the braking of all wheels of the vehicle and of a trailer 
vehicle (which may be present) when the braking system is 
intact, and a second brake circuit (secondary circuit), 

25 which controls the braking of all wheels of the vehicle 
and of a trailer vehicle (which may be present) if the 
service brake circuit, that is to say the first brake 
circuit, has failed. 

In this case, the first brake circuit is formed primarily 
3 0 by the pressure regulation modules 11, 12 on the front 
axle and the pressure regulation modules 27, 28 on the 
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rear axle. Analogously to fig. 1, the pressure regulation 
modules 11, 12 are supplied with storage pressure by the 
first pressure -medium vessel 14 via a pneumatic line 13. 
The second pressure -medium vessel 30 supplies the 
5 pressure regulation modules 27, 28 via the pneumatic line 
29. 

The pressure regulation modules 11, 12 are also connected 
to a control output 60 of a foot brake valve 61 via a 
pneumatic control line 60' . The pneumatic control line 
10 60' is likewise connected to the first pressure-medium 
vessel 14 via the foot brake valve 61. 

The second pressure-medium vessel 30 is connected, via 
the foot brake valve 61, to a control output 62 of the 
foot brake valve 61, to which control inputs 64, 65 of 
15 pressure regulation modules 66, 67 of the second brake 
circuit are connected via a control line 62' . The 
pressure regulation modules 66, 67 of the second brake 
circuit are also connected to the third pressure -medium 
vessel 47 via a pneumatic supply line 68, 69. 

20 The pressure regulation modules 27, 28 of the service 
brake circuit on the rear axle are likewise connected to 
the pneumatic control output 60 of the foot brake valve 
61 via a pneumatic control line 70. 

Like the front axle, two further pressure regulation 
25 modules 71, 72 of the second brake circuit are also 
provided on the rear axle, said pressure regulation 
modules being supplied with compressed air by the third 
pressure-medium vessel 47 via the pneumatic supply line 
68, 69 and likewise being connected to the pneumatic 
3 0 control output 62 of the foot brake valve 61 via a 
pneumatic control line 63. The pressure regulation 
modules 66, 67, 71, 72 of the second brake circuit are 
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connected to the second electronic control unit 42 via 
electrical connecting lines 73. It goes without saying 
that it is possible to assign the pneumatic control 
outputs 60, 62 of the foot brake valve 61 to the pressure 
5 regulation modules 11, 12, 27, 28, 66, 67, 71, 72 in 
another manner. 

Analogously to this, the pressure regulation modules 11, 
12, 27, 28 of the service brake circuit are connected to 
10 the first electronic control unit 20 via an electrical 
line 74. 

The pressure regulation modules 11, 67 and 12, 66 are 
each connected to the brake cylinders 3, 4 via an 
associated high-pressure selection valve 75, 76 and the 
15 pneumatic lines 9, 10. 

Analogously to fig. 1, the brake lining wear sensors 5, 6 
and the wheel speed sensors 7, 8 are connected to the 
pressure regulation modules 11, 12 of the service brake 
circuit. In addition to this, a second wheel speed sensor 
20 77, 78 is respectively provided in the exemplary 
embodiment shown in fig. 2, said wheel speed sensors 
being connected to the pressure regulation modules 67 and 
66 of the second brake circuit. 

Analogously to this, wheel speed sensors 79, 80 and brake 
25 lining wear sensors 35, 36, which are connected to the 
pressure regulation modules 71, 72 of the second brake 
circuit, are also provided on the rear axle in addition 
to the wheel speed sensors 37, 38 which are connected to 
the pressure regulation modules 27, 28 of the service 
30 brake circuit. 
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The foot brake valve 61 also has electrical control 
outputs which are connected, on the one hand, to the 
electronic control unit 20 via an electrical line 81 and, 
on the other hand, to the electronic control unit 42 via 
5 an electrical line 82. Analogously to fig. 1, control 
inputs of the parking brake valve 32 (which additionally 
has a further manual control input 83 in this case) are 
connected to the electronic control unit 20 and to the 
electronic control unit 42. 

10 In addition to fig. 1, a further pressure regulation 
module 84 which is connected to a trailer control valve 
85 via a pneumatic control line are provided in fig. 2. 
The pressure regulation module 84 is supplied with 
storage pressure by the third pressure-medium vessel 47 

15 via the storage line 69 and is connected to the second 
electronic control unit 42 via an electrical control line 
86. A pneumatic control line 87 for the parking brake of 
a trailer vehicle is also provided between the parking 
brake valve 32 and the trailer control valve 85. The 

20 trailer control valve 85 is likewise connected to the 
first electronic control unit 20 via an electrical 
control line 88. 

Analogously to fig. 1, the two electronic control units 
20, 42 are connected to the positive terminals VI and V2 

25 via the lines 52, 53 and to bus lines VehComl and VehCom2 
via the lines 50, 51. Connecting lines 89, 90 to TrComl 
and TrCom2 connections are additionally provided in this 
case, said connections leading to a trailer. Power supply 
via the batteries 54, 55 corresponds to fig. 1. In 

30 contrast to fig. 1, the pressure distribution device 48 
is likewise connected to the VehComl bus here, can 
isolate a faulty compressed-air supply circuit and 
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maintains the requisite system pressure for all of the 
other circuits. 

Like fig. 1, the two electronic control units 20, 42 are 
connected to one another via the electrical line 58 and 
5 the DC-isolation device 59. This connection prevents an 
actuator, for example, being activated by different 
control devices at the same time. 

Analogously to the front axle, the pressure regulation 
modules 27, 71 and 28, 72 are also each connected, on the 
10 rear axle, to inputs of the spring brake cylinders 23, 24 
via a high-pressure selection valve 91, 92. 

The high-pressure selection valves (high select) 75, 76, 

91, 92 ensure that the higher of the two brake pressures 
of the connected brake circuits is respectively 

15 transmitted to the brake cylinders. During normal 
operation, the service braking system "overrides" the 
second braking system, the pressures in the second brake 
circuit being somewhat lower than in the service brake 
circuit. This ensures reliable pressure control and makes 

20 it possible for the second brake circuit to check its own 
"operational capability", for example by measuring the 
pressure at the outputs of the pressure regulation 
modules 66, 67 and 71, 72 of the second brake circuit, 
that is to say upstream of the high-pressure selection 

25 valves 75, 76, 91, 92. 

The valve components are now present "singly" from the 
output of the high-pressure selection valves 75, 76, 91, 

92. They are accordingly of failsafe design. 

The uppermost level of the electronic control system of 
3 0 the braking system is implemented using the two 
electronic control units 20, 42 (main electronic control 
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unit and second electronic control unit) . The two 
electronic control units have two communications 
connections 58, 59 which are independent of one another 
and are DC-isolated from one another. These ''connecting 
5 lines" can be used to carry out plausibility checks on 
the two independent circuits. "Learnt" and instantaneous 
or measured braking parameters can also be exchanged. The 
"main ECU" (electronic control unit 20) controls all of 
the vehicle brakes during normal operation and also if 
10 the second system has developed a fault or has failed. 

In the event of the main braking system failing, the 
second system controls braking. The main system has a 
pneumatic pressure supply via the pressure -medium store 
14 for the front axle and via the pressure -medium store 
15 3 0 for the rear axle and controls the pressures using the 
associated pressure regulation modules 11, 12, 27, 28. 

In order to increase reliability, two wheel speed sensors 
are provided at each wheel, one being assigned to the 
respective pressure regulation module of the service 
20 brake circuit and the other being assigned to the 
associated pressure regulation module of the second brake 
circuit . 

The foot brake valve 61 is connected to the two ECUs, 
that is to say to the electronic control units 20, 42, 
25 with the result that DC-isolation is ensured, thus 
enabling plausibility checks. 

Each ECU has a data connection to its associated 
superordinate control unit, from which external braking 
requests can be accepted. These data connections must, of 
30 course, be DC-isolated from the two braking control 
circuits . 
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The parking brake is activated exclusively electronically 
by the two independent ECUs and is directly activated 
electrically by the driver, to be precise in the 
following manner. Electrical actuation of the parking 
5 brake by the driver precedes electronic control by the 
two ECUs. However, the parking brake is released only 
when there are release signals from the ECUs and from the 
driver . 

Fig. 3 shows an enlarged illustration of the power supply 
10 system for the braking control system shown in fig. 2. A 
generator 93 (dynamo) generates a voltage and is 
connected to the positive terminal of the battery 54 and 
to the DC-isolation device 56 (supply duplicator unit). 
The positive terminal of the battery 55 is likewise 
15 connected to the DC-isolation device. The positive 
terminals of the two batteries 54, 55 are thus DC- 
isolated. The DC-isolation may be realized, for example, 
using a converter with electromagnetic transmission. 

The negative terminals of the two batteries 54, 55 and 
2 0 the generator 93 each have a common ground connection 
(GND) . The potential VI can be tapped off from the 
positive terminal of the battery 54 and the potential V2 
can be tapped off from the positive terminal of the 
battery 55. The isolation device 56 also has electronic 
25 monitoring units 94, 95 which are connected to the bus 
lines VehComl and VehCom2 . The electronic monitoring 
units 94, 95 monitor and control the charging and 
discharging operations, to be precise in such a manner 
that the lives of the batteries are optimized. 

30 Since not all of the electrical systems in a vehicle are 
relevant to safety, not all of the systems need to be 
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"duplicated" either. The power supply system is therefore 
of "asymmetrical" design. 

The main system, that is to say, for example, the battery 
54, supplies power to all of the main loads, for example 
5 starter, lights, drive controller, the primary electronic 
braking control circuit, the primary electronic steering 
control circuit etc. The secondary system, that is to say 
the battery 55, supplies power to the "subordinate" back- 
up components of all the safety-relevant systems, that is 
10 to say the electronic back-up braking control circuit and 
an electronic back-up steering control circuit. 

On account of the "asymmetry" , the second battery may 
have a smaller capacity than the first, and another type 
of battery may also be used. The batteries 54, 55 are 
15 thus matched to one another in terms of size, capacity, 
charging and discharging curves etc. 

The AC generator 93 (dynamo) charges the first battery 54 
and - in a DC- isolated manner - also the second "back-up 
battery" 55. In the event of a fault in a supply circuit, 
2 0 the "supply duplicator unit" 56 and the electronic 
monitoring units ensure the integrity of the other 
circuit . 

Optimum use of the batteries requires charging and 
discharging methods which are matched to the batteries, 

2 5 this being monitored by the electronic control devices 
94, 95. The charging and discharging operations are thus 
intended to be carried out, as far as possible, in 
accordance with prescribed "charging and discharging 
curves". The electronic control devices 94, 94 are thus 

30 used as "intelligent charging and discharging control 
devices" . 
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Since, in the case of fully electronic control of safety- 
relevant systems, the state of the batteries is a very 
important item of information, the isolation device 56 
has two DC- isolated data connections (not shown) via 
5 which battery state signals are transmitted. 

Fig. 4 shows a schematic exemplary embodiment of the 
parking brake valve 32 . It comprises two function valves 
FV1, FV2 , two locking valves LV1, LV2 , two pressure 
sensors PS1, PS2 and two trailer check valves TCI, TC2 . 

10 The valves FV1 and LV2 switch the upper air path of the 
parking brake valve 32, and the valves FV2 and LV1 switch 
the lower air path. The valves FV1 and LV1 are controlled 
by the first electronic control unit 20, and the valves 
FV2 and L.V2 are controlled by the electronic control unit 

15 42. Normally, the function valves FV1 , FV2 control the 
functioning of the parking brake. In the event of a fault 
in a function valve (for example FV2) , the associated 
locking valve LV1 will block the faulty air path. 

A relay valve RV is a power valve and is controlled by 
2 0 the valves FV1 , FV2 , LV1 , LV2 since the latter are not 
capable of actuating the spring brake cylinders 23, 24 
rapidly enough. 

The trailer check valves TCI, TC2 are responsible for 
checking the spring brake action. 

25 If the function valve FV1 or its controller has a fault, 
the locking valve LV2 is actuated and the upper air path 
is thus blocked. In this case, correct functioning is 
still ensured by the function valve FV2 and the locking 
valve LV1 . 
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If the locking valve LV2 or its controller has a fault, 
the two function valves FV1, FV2 must still be activated, 
and correct functioning is thus still maintained. 

In order to detect faults in the parking brake system, 
5 use is made of two pressure sensors PS1, PS2 which are 
interrogated in the switching sequences of the function 
valves FV1, FV2 and locking valves LV1 , LV2 . 

In the event of all the electrical supply voltages 
failing, the parking brake valve 32 will brake. 

10 Fig. 5 shows a schematic illustration of networked 
electronic control systems having multiple redundancy 
levels. Only control systems ECU_1 to ECU_16 with their 
supply lines and communications connections are shown. 
The control systems are arranged in system groups. ECU_1 

15 to ECU_5 are the basic systems, for example brake, 
steering, vehicle dynamics, engine control, transmission 
control etc. These systems are supplied by a power 
generator G via a supply line V_l . The associated energy 
store is a battery BATT_1 . The next group is formed by 

20 the control systems ECU_6 to ECU_8 , which group is also 
supplied by the power generator G. However, the supply 
line contains a transducer TR_1 , to which a supply line 
V_2 is connected. The group of control systems ECU_6 to 
ECU_8 are the most safety-critical redundant pairs of the 

25 control systems ECU_1 to ECU_5 (for example brake 2, 
steering 2, vehicle dynamics 2) . 

The communications lines of the control systems are also 
isolated from one another by transducers. A 
communications connection thus exists, for example, 
3 0 between the control systems ECU_1 to ECU_8 by virtue of 
the communications line COM 1 which is connected to a 
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communications line COM_2 of the control systems ECU_6 to 
ECU_8 by the transducer TR_1 . 

Fig. 5 shows quadruple redundancy in which four 
transducers TR_1 to TR_4 are used. 

5 The position of the control systems ECU__15 to ECU__16 
shows another possible way of using transducers. These 
control systems are connected to one another by means of 
a supply line V_5 and a communications line COM_5 and are 
connected to the transducer TR_4 . The transducer TR_4 
10 forms the connection to the supply line V_3 and to the 
communications line COM_3 which are, in turn, connected 
to the supply line V_l and to the communications line 
COM_l by means of a further transducer TR_2 . 

The transducers TR_1 to TR_4 form DC- isolation devices 
15 between the various redundancy levels. 
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